MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8
SHA3-384 hash: a8dad6534acb1d8adc6b4e5bfcbc4cd53ff588a37ba31236231a6a52eedb1fa28726c271bd4610789c5b7e9c604b9c5b
SHA1 hash: 5fc357db30ec757fd4d046c34b14cc5b6604bc26
MD5 hash: 773cefd4d9ec88ca7dee9d9f58b89688
humanhash: salami-magnesium-two-speaker
File name:bitcoin.exe
Download: download sample
File size:13'824 bytes
First seen:2021-05-06 14:09:48 UTC
Last seen:2021-05-06 15:20:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 192:ETZxH3NCFmtcDDQXWy1ypy5xKGIclp46Ip1GKsJ9oZjlAfz0DMMgvuOjOn:ETZzSIc/QXWyoFclpJKkkjyrBNa
Threatray 115 similar samples on MalwareBazaar
TLSH FC523A06A7E6877BCBBD1F778873A5500ABAC704A55BBF3D8CD810660EA33444773661
Reporter starsSk87264403

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://159.69.142.67/ahmad/bitcoin.exe
Verdict:
No threats detected
Analysis date:
2021-04-27 18:30:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4d06648b-61cf-4714-ba85-82e99061e6fa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/151673/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46146846.31327.32621.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/716409
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8/
Threat name:
ByteCode-MSIL.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 20:37:28 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0dd3510b1088c0dd5ebd7f3692d6eeec53009cd6fb8de87650bfaf71bc5dcd07
282406408e4499b5e5807fbb08409ae8c1456efb75281da653d366dad299d5df
31be15bca048be274cf57fe357a7fe192fdf045cd2c93c2e13a42972db30ddf8
448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b
5564f628b877cee2359d1b9321ec6c4ae20cd4d168ad678afeadf126608af514
9805f831143f829fc80312327d3bd55e597c3d85431525aca68b2ccbf10053b7
c33d8b5589880c1a82f257555f5dea36190e409cff9b2980ab80b314ccb11bae
ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce
e099242d7dceaf2629624cdb0e3cdadea490d1d0b117577e50b47dce5d86eb00
e34a91674a3a3aed881705d2f7deee4607a96a9abeb1a4a8fcbdbc9a3a560937
+ 105 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210506-qkqw3pb6ex/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Unpacked files
SH256 hash:
2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8
MD5 hash:
773cefd4d9ec88ca7dee9d9f58b89688
SHA1 hash:
5fc357db30ec757fd4d046c34b14cc5b6604bc26
Link:
https://www.unpac.me/results/940bb842-38e0-4c22-9b5d-8486664edf20/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 2a07a267504200452790e7c1f70c31dbf23f20dadd8fca4bc47be501f0fc6ee8

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/151673/
  
URLhaus
https://urlhaus.abuse.ch/url/1194993/
  
Delivery method
Distributed via web download

Comments